What is SOAR? Automating the response, not the decision
SOAR platforms automate the repetitive parts of incident response. Where they earn their cost, where they fail, and how they differ from SIEM and XDR.
SOAR stands for Security Orchestration, Automation and Response. It is a category of tooling that connects the systems a security team already uses and runs defined sequences of actions across them, so that the mechanical parts of responding to an alert happen without a person doing them by hand.
The three words, separately
- Orchestration — connecting tools that do not talk to each other. Pulling a reputation score from a threat intelligence service, a user's group membership from the directory, and recent logins from the identity provider, into one view.
- Automation — performing actions without a human: isolating an endpoint, disabling an account, blocking a hash.
- Response — the case management around it, so that what happened is recorded and reviewable.
SIEM, SOAR, XDR
These overlap and vendors blur them deliberately.
- SIEM collects and correlates logs, and produces alerts. It tells you something happened.
- SOAR takes an alert and acts on it. It does something about what happened.
- XDR is a vendor's integrated detection and response across its own products — narrower than SIEM, more automatic than SOAR, and generally limited to that vendor's telemetry.
A SOAR platform without a SIEM has nothing to trigger it. A SIEM without SOAR means analysts do the same manual steps repeatedly.
What a playbook actually looks like
Take a phishing report from a member of staff:
- Parse the reported message: sender, headers, URLs, attachment hashes.
- Enrich each artefact — URL reputation, hash lookups, whether the sending domain was registered recently.
- Search the mail platform for other copies of the same message across all mailboxes.
- If the verdict is malicious, remove every copy and block the sender.
- Check whether anyone clicked, using proxy or DNS logs.
- For anyone who clicked and submitted credentials, revoke sessions and force a reset.
- Reply to the reporter, and open a case with everything recorded.
Done manually, that is twenty to forty minutes. Automated, it is under a minute — and the searching step is the one that matters most, because it finds the ninety other recipients who have not reported yet.
Where the value actually is
The saving is not "replacing analysts". It is in three specific places:
- Enrichment. Gathering context is pure mechanical work and the largest share of handling time.
- Consistency. A playbook performs step six every time, including at 3am on a Sunday.
- Containment speed. The interval between detection and isolation is where automation changes outcomes rather than just saving effort.
Where it fails
Automating decisions rather than actions
Automatic enrichment is almost always safe. Automatic action needs care proportional to its blast radius. A playbook that disables accounts on a noisy detection will eventually disable the wrong one — and if it can disable an administrator, it can lock out the people who would fix it. Keep destructive actions behind an approval step until the detection feeding them has a demonstrated false-positive rate.
Building before the process exists
Automating an undocumented process produces an automated mess that is harder to change than the manual version. If the team cannot describe the steps consistently on paper, there is nothing to automate yet.
Playbook rot
Playbooks break silently when an API changes or a tool is replaced. A playbook that has not run successfully in three months should be treated as broken until proven otherwise, and the platform should alert on execution failures as loudly as on detections.
A sensible order to adopt it
- Instrument the process you have. Measure where analyst time actually goes for a month.
- Automate enrichment only. No actions. This is low risk and usually removes the largest block of time.
- Add containment behind approval, so a human clicks but does not perform the steps.
- Remove the approval only for detections with a measured, low false-positive rate.
Teams that start at step four buy an expensive platform and turn most of it off after the first bad automatic action.
